CI

dma check is the only check that must block merge. Linters in CI are useful, but without the CLI you will not see cycles and inbound predicates.

Minimal step

npx @derived-modular/cli check .

Exit code 1 — architectural violations. Exit code 2 — environment problem (missing src/, broken tsconfig).

Add the command to the pipeline after install and before deploy.

GitHub Actions

name: Architecture

on:
  pull_request:
  push:
    branches: [main]

jobs:
  dma:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - run: npm ci

      - run: npx @derived-modular/cli check . --format json

For bun:

      - uses: oven-sh/setup-bun@v2

      - run: bun install --frozen-lockfile

      - run: bun x @derived-modular/cli check .

JSON for scripts and agents

npx @derived-modular/cli check . --format json > dma-report.json

The report is stable (version: 1) — easy to parse in custom CI, bots, and AI agents.

SARIF for GitHub Code Scanning

npx @derived-modular/cli check . --format sarif > dma.sarif

Upload the artifact to Code Scanning — violations appear in the Security tab alongside other analyzers.

What to run together

doctor in CI only makes sense as an informational job — growth signals, not a gate.

Monorepo

From the workspace root (no src/ there), discover and check all DMA apps in one call:

npx @derived-modular/cli check .
npx @derived-modular/cli check --roots apps/web,apps/admin

Or per package / turbo filter. Details — Monorepo.

Examples in the DMA repository

All examples pass dma check. In the DMA monorepo CI:

- name: DMA-check examples
  run: bun run dma-check:examples

Common mistakes

What's next